SynapLogic contract vulnerability triggers large arbitrage: missing parameter validation leads to excessive withdrawal

【ChainWen】There is a contract security issue worth noting. The SynapLogic’s swapExactTokensForETHSupportingFeeOnTransferTokens function has a serious vulnerability—missing critical parameter validity checks.

What did the attacker do using this vulnerability? Bypassed the whitelist mechanism, specified their own profit address, and directly received the extracted funds. Even more surprisingly, the contract did not verify the total distribution amount of the native tokens, allowing the attacker to arbitrage from two channels at once: first, over-extracting the native tokens themselves; second, simultaneously obtaining newly minted SYP tokens. Both methods combined.

The final result was approximately $186,000 USD being directly transferred away. This case once again reminds developers—when handling token transfers and whitelist logic, parameter boundary checks are essential, and maximum amount validation must be in place. Small oversights can sometimes lead to major vulnerabilities.